INC Ransomware is suspected of chaining CVE-2026-15409 and CVE-2026-15410 to steal credentials, TOTP seeds, and reach internal networks.

The INC Ransomware group has been behind most attacks targeting two recent vulnerabilities in SonicWall’s SMA1000 appliances.

INC Ransomware is suspected of chaining CVE-2026-15409 and CVE-2026-15410 to steal credentials, TOTP seeds, and reach internal networks.